Privacy Policy

[Note: DPDP Act 2023 data-subject rights (export/erasure/access) requests are currently processed manually upon request.]

This policy explains what personal data Prebit Engage (operated by Prebit, "we") collects, why, and what rights apply — both for merchants who use the Service and for your customers, whose data your store shares with us to provide the Service.

1. Two roles: controller and processor

• For your own account data (your name, email, business details, billing information), Prebit Engage is the data controller.
• For your customers' data (synced from your connected store, and messaging engagement data generated on our platform), you are the data controller and Prebit Engage is the data processor, acting only on your instructions — see the Data Processing Agreement.

If you are a customer of one of our merchants and have a question about your own data, please contact that merchant directly; they control that relationship.

2. What we collect

About you (the Merchant):

• Account details: name, email, phone, business name
• Billing details processed via Razorpay (we do not store full card/bank details ourselves)
• Usage data: login activity, feature usage, support interactions

About your customers (via your connected store):

• Identity: name, email, phone
• Commerce data: orders, products viewed/purchased, cart contents, lifetime spend
• Consent status per channel (WhatsApp/email/SMS), as synced from your store or recorded on our platform
• Messaging engagement: delivery/open/click/reply status per message we send on your behalf

3. How we use it

• To provide the Service: sync your store, run automations/campaigns, send messages you configure
• To enforce consent — we check consent status before every marketing send
• To bill your subscription and wallet usage via Razorpay
• To monitor and protect deliverability/sender reputation
• To detect abuse and enforce the Acceptable Use Policy
• Aggregated, de-identified usage data to improve the Service

We do not sell personal data.

4. Who we share it with (subprocessors)

We use the following categories of subprocessors to operate the Service; a current list with named vendors is available on request:

5. Data security

Credentials for your connected accounts (e.g. store access tokens) are encrypted at rest using envelope encryption, never stored in plaintext, and never logged. All actions on your data are authenticated and authorized server-side.

6. Data retention

We retain your account and customer data for as long as your account is active, and for a limited period after cancellation to allow reactivation and meet legal/accounting obligations, after which it is deleted or anonymized.

7. Your rights (and your customers' rights)

Subject to applicable law (including India's DPDP Act, 2023), you and your customers may request: access to personal data held, correction of inaccurate data, deletion/erasure, and withdrawal of marketing consent (which we enforce technically before any future send). To exercise these rights, contact [email protected] (currently processed manually upon request).

8. Cookies

The marketing site and dashboard use cookies for authentication and analytics — see the Cookie Policy.

9. Children's data

The Service is not directed at individuals under 18, and we do not knowingly process children's personal data as controller.

10. International transfers

[Note: Specify hosting region(s) once finalized, and whether any subprocessor transfers data outside India — required disclosure if applicable.]

11. Changes to this policy

We will notify merchants of material changes via the dashboard and/or email at least 15 days before they take effect.

12. Contact / Grievance Officer

Per India's IT (Intermediary Guidelines) Rules, 2021:

• Grievance Officer: [Grievance Officer Name]
• Email: [email protected]
• Address: Najafgarh, South West Delhi